Microsoft warns about Java vulnerabilities

Software Imperium Microsoft is warning about a spike in the number of attacks using vulnerabilities in Java.

Microsoft insecurity expert Holly Stewart said that she was looking at exploit data that the Imperium detects with its antimalware technology.

The main focus of antimalware software is on traditional malware families and writing in her bog Stewart said that some of those were telling a scary story.

She said there was an unprecedented wave of Java exploitation. By the beginning of this year, the number of attacks on vulnerable Java code had surpassed the total number of Adobe-related exploits.

She said that the Java spike in Q3 was driven by attacks on three vulnerabilities, which all have had patches available for them for some time now.

The first two have gone from hundreds of thousands per quarter to millions:

“Java is ubiquitous, and, as was once true with browsers and document readers like Adobe Acrobat, people don’t think to update it,” she said.

Her theory as to why almost no one has noticed this sharp rise in attacks on Java is that IDS/IPS vendors, who are typically the people that speak out first about new types of exploitation, have challenges with parsing Java code.

They would have to incorporate a Java interpreter into an IPS engine which would cripple a network.

The people that we expect to notice increases in exploitation might have a hard time seeing this particular spectrum of light. Call it Java-blindness, she said.